From 444b51611b46066a1db01c1d774eaf415d3d684f Mon Sep 17 00:00:00 2001
From: Cherno Jagne <cherno@autar.ai>
Date: Fri, 7 Aug 2026 07:19:07 -0500
Subject: [PATCH 1/3] Add actionlint configuration and CI workflow

Sets up actionlint to lint GitHub Actions workflow files on push/PR.
Adds .github/actionlint.yaml config with ShellCheck integration and
.github/workflows/actionlint.yml dedicated CI workflow triggered on
workflow file changes.
---
 .github/actionlint.yaml          | 14 +++++++++++++
 .github/workflows/actionlint.yml | 34 ++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 .github/actionlint.yaml
 create mode 100644 .github/workflows/actionlint.yml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 000000000..b722b6ebf
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,14 @@
+# actionlint configuration
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md
+self-hosted-runner:
+  labels: []
+
+# ShellCheck rules disabled inside run: blocks.
+# Each `run:` block is checked through ShellCheck; suppress noisy rules here.
+paths:
+  ".github/workflows/**/*.{yml,yaml}":
+    ignore:
+      - 'shellcheck reported issue in this script: SC1091:.+'  # Can't follow non-constant source
+      - 'shellcheck reported issue in this script: SC2086:.+'  # Double-quote to prevent globbing/word splitting
+      - 'shellcheck reported issue in this script: SC2129:.+'  # Consider using { cmd1; cmd2; } >> file
+      - 'shellcheck reported issue in this script: SC2155:.+'  # Declare and assign separately to avoid masking return values
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 000000000..6b7a282a2
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,34 @@
+name: Actionlint
+
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actionlint.yaml'
+      - '.github/actionlint.yml'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actionlint.yaml'
+      - '.github/actionlint.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: actionlint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Download actionlint
+        id: download
+        run: bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        shell: bash
+      - name: Run actionlint
+        run: |
+          ./actionlint -color
+        shell: bash

From d9ab2cbc259ad53c4ba81677486b7a738f6ba5e7 Mon Sep 17 00:00:00 2001
From: Cherno Jagne <cherno@autar.ai>
Date: Fri, 7 Aug 2026 07:22:33 -0500
Subject: [PATCH 2/3] fix(ci): use top-level ignore list in actionlint config

The paths: key is not a valid actionlint config option; only
self-hosted-runner, ignore, and config-variables are supported at the
top level. The nested ignore patterns were silently discarded, so
pre-existing SC2006/SC2046 errors in main.yml triggered CI failures.
---
 .github/actionlint.yaml | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index b722b6ebf..2aa40c805 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -3,12 +3,11 @@
 self-hosted-runner:
   labels: []
 
-# ShellCheck rules disabled inside run: blocks.
-# Each `run:` block is checked through ShellCheck; suppress noisy rules here.
-paths:
-  ".github/workflows/**/*.{yml,yaml}":
-    ignore:
-      - 'shellcheck reported issue in this script: SC1091:.+'  # Can't follow non-constant source
-      - 'shellcheck reported issue in this script: SC2086:.+'  # Double-quote to prevent globbing/word splitting
-      - 'shellcheck reported issue in this script: SC2129:.+'  # Consider using { cmd1; cmd2; } >> file
-      - 'shellcheck reported issue in this script: SC2155:.+'  # Declare and assign separately to avoid masking return values
+# ShellCheck rules suppressed across all run: blocks.
+ignore:
+  - 'shellcheck reported issue in this script: SC1091:.+'  # Can't follow non-constant source
+  - 'shellcheck reported issue in this script: SC2006:.+'  # Use $(...) instead of backticks
+  - 'shellcheck reported issue in this script: SC2046:.+'  # Quote to prevent word splitting
+  - 'shellcheck reported issue in this script: SC2086:.+'  # Double-quote to prevent globbing/word splitting
+  - 'shellcheck reported issue in this script: SC2129:.+'  # Consider using { cmd1; cmd2; } >> file
+  - 'shellcheck reported issue in this script: SC2155:.+'  # Declare and assign separately to avoid masking return values

From 7633b548ccb830db14227d4367d8979f5bc4eb9e Mon Sep 17 00:00:00 2001
From: Cherno Jagne <cherno@autar.ai>
Date: Fri, 7 Aug 2026 07:27:52 -0500
Subject: [PATCH 3/3] fix(ci): quote variables and replace backticks in
 main.yml shell steps

---
 .github/workflows/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5e60406e7..483c00f92 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -80,7 +80,7 @@ jobs:
         df -h /
     - name: Chown user
       run: |
-        sudo chown -R $USER:$USER $GITHUB_WORKSPACE
+        sudo chown -R "$USER":"$USER" "$GITHUB_WORKSPACE"
     - uses: actions/checkout@master
     - uses: actions/setup-python@v5
       name: Setup Python ${{ matrix.python-version }}
@@ -129,7 +129,7 @@ jobs:
         pip3 install -r requirements-django.txt
         pip3 install -r requirements-pubsub.txt
         pip3 install .
-        pip3 install GDAL==`gdal-config --version`
+        pip3 install GDAL=="$(gdal-config --version)"
     - name: setup test data ⚙️
       run: |
         pybabel compile -d locale -l es